Fix OData filter format in JWT string claims

[aaronburtle]

Why make this change?

Fixes the format of the OData filter in JWT string claims.

What is this change?

In AuthorizationResolver we now escape embedded single quotes in claim values by doubling them, before we wrap the value in single quotes for OData substitution. This conforms to the OData 4.01 ABNF rule for string literals (Section 7: Literal Data Values).

Policy: @item.col1 eq @claims.userId
Claim userId value: alice' or 1 eq 1 or '

	Resulting OData predicate
Before	col1 eq 'alice' or 1 eq 1 or '' <- injects or 1 eq 1, bypassing row-level auth
After	col1 eq 'alice'' or 1 eq 1 or ''' <- attacker payload contained inside a single string literal

How was this tested?

New parameterized test DbPolicy_StringClaim_SingleQuotesEscaped_PreventsODataInjection in src/Service.Tests/Authorization/AuthorizationResolverUnitTests.cs covers:

• Active OR-predicate injection attempt is neutralized.
• Legitimate apostrophe-bearing value (e.g. O'Brien) is safely escaped.
• Value composed solely of single quotes is fully escaped.
• Value with no single quotes is unchanged aside from the enclosing quotes (no regression).

Sample Request(s)

{
  "entities": {
    "Note": {
      "source": "dbo.Notes",
      "permissions": [
        {
          "role": "authenticated",
          "actions": [
            {
              "action": "read",
              "policy": { "database": "@item.ownerId eq @claims.userId" }
            }
          ]
        }
      ]
    }
  }
}

Reproduction - userId claim value of alice' or 1 eq 1 or ':

GET /api/Note HTTP/1.1
Authorization: Bearer <jwt-with-crafted-userId-claim>
X-MS-API-ROLE: authenticated

• Before fix: the engine emitted WHERE ownerId = 'alice' or 1 eq 1 or '', returning rows owned by other users.
• After fix: the engine emits WHERE ownerId = 'alice'' or 1 eq 1 or ''', which compares against the literal string alice' or 1 eq 1 or ' and returns no unauthorized rows.

[Copilot]

Pull request overview

This PR fixes an OData injection vector in database authorization policies by correctly escaping single quotes inside JWT string claim values before substituting them into the policy expression.

Changes:

• Escape embedded single quotes in string-typed JWT claim values by doubling them before enclosing in single quotes for OData literals.
• Add a new parameterized unit test validating the escaping behavior across malicious and benign inputs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/Core/Authorization/AuthorizationResolver.cs	Escapes single quotes in string claim values to keep substituted OData literals well-formed and non-injectable.
src/Service.Tests/Authorization/AuthorizationResolverUnitTests.cs	Adds a parameterized test covering injection attempt neutralization and correct escaping for common edge cases.